Method and system for generating an identity identifier of a key

• US 20110123029A1
• Filed: 06/15/2009
• Published: 05/26/2011
• Est. Priority Date: 06/16/2008
• Status: Active Grant

• Current Assignee: ZTE Corporation
• Original Assignee: ZTE Corporation
• Inventors: Huang, Qing, Zhang, Xuwu
• Granted Patent: US 8,750,515 B2
• Time in Patent Office: Days
• US Class Current: 380/272
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/041 using an encryption or decryption engine integrated in transmitted data
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

A method for generating an identifier of a key, comprises that: when a user equipment (UE) transfers from an evolved UMTS terrestrial radio access network (EUTRAN) to a universal terrestrial radio access network (UTRAN) or a global system for mobile communications (GSM), or an enhanced data rate for GSM evolved radio access network (GERAN), an identifier of a system key after transfer is generated by mapping an identifier KSI_ASME for an access security management entity, and a mobile management entity generates an identifier of a ciphering key (CK) and an integrity key (IK) by mapping the KSI_ASME, and then sends the generated identifier to a serving GPRS support node (SGSN), when the UE transfers from the EUTRAN to the UTRAN, the SGSN stores the ciphering key, the integrity key and the identifier thereof, and when the UE transfers from the EUTRAN to the GERAN, the SGSN assigns the value of the identifier of the ciphering key and the integrity key to an identifier of a ciphering key of the GERAN.

Claims

1. A method for generating an identifier of a key, comprising:

when a user equipment (UE) transfers from an evolved UMTS terrestrial radio access network (EUTRAN) to a universal terrestrial radio access network (UTRAN), a mobility management entity (MME) and the UE generating a key set identifier of a UTRAN system by mapping a key set identifier of an access security management entity key; and

the MME sending a serving GPRS support node (SGSN) the key set identifier of the UTRAN system, along with a ciphering key and an integrity key of the system.

2. The method according to claim 1, wherein the generation method of the mapping comprises:

the UE and the MME directly assign the value of the key set identifier of the UTRAN system to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and network side.

3. The method according to claim 1, wherein when the UE transfers from the EUTRAN to the UTRAN in an idle state, after receiving a user information extraction request message sent by the UE to the SGSN, the MME generates an integrity key and a ciphering key using the key of the access security management entity, generates an identifier of the integrity key and the ciphering key, that is, a key set identifier, by mapping the key set identifier for the access security management entity, and sends the integrity key, the ciphering key and the key set identifier to the SGSN via a user information extraction response message;

and the SGSN stores the ciphering key, the integrity key and the key set identifier.

4. The method according to claim 3, wherein the request message sent by the UE to the SGSN for transferring to the UTRAN in an idle state is a routing area update request message;

correspondingly, the user information extraction request message is a context request message; and

the user information extraction response message is a context response.

5. The method according to claim 3, wherein the request message sent by the UE to the SGSN for transferring to the UTRAN in an idle state is an attachment request message;

correspondingly, the user information extraction request message is an identification request message; and

the user information extraction response message is an identification response.

6. The method according to claim 1, wherein after determining to transfer to the UTRAN in an idle state and before correspondingly sending the SGSN a message indicative of the completion of the transfer to the UTRAN in an idle state, the UE generates a key set identifier by mapping the key set identifier of the access security management entity key, and stores the key set identifier, along with the integrity key and the ciphering key which are generated from the key of the access security management entity.

7. The method according to claim 6, wherein the message sent by the UE to the SGSN for indicating the completion of the transfer to the UTRAN in an idle state is a routing area update completion message or an attachment completion message.

8. The method according to claim 1, wherein when the UE transfers from the EUTRAN to the UTRAN under the condition that a radio resource control (RRC) is in an active state, after receiving a handover request, the MME generates an integrity key and a ciphering key using the key of the access security management entity, generates an identifier of the integrity key and the ciphering key, that is, a key set identifier, by mapping the key set identifier of the access security management entity key, and sends the integrity key, the ciphering key and the key set identifier to the SGSN via a forward redirecting request message;

the SGSN stores the ciphering key, the integrity key and the key set identifier; and

after receiving a handover command sent by the network side, the UE generates a key set identifier by mapping the key set identifier of the access security management entity key and stores the key set identifier, along with the integrity key and the ciphering key which are generated from the key of the access security management entity.

9. The method according to claim 1, wherein if a key is associated by the network side and the UE before the UE transfers, and if the key set identifier associated before the transfer is the same as that of the system key which is generated by mapping the key set identifier of the access security management entity key during the transferring process, then the keys stored in the SGSN and the UE before the transfer are deleted.

23. The method according to claim 2, wherein when the UE transfers from the EUTRAN to the UTRAN in an idle state, after receiving a user information extraction request message sent by the UE to the SGSN, the MME generates an integrity key and a ciphering key using the key of the access security management entity, generates an identifier of the integrity key and the ciphering key, that is, a key set identifier, by mapping the key set identifier for the access security management entity, and sends the integrity key, the ciphering key and the key set identifier to the SGSN via a user information extraction response message;

and the SGSN stores the ciphering key, the integrity key and the key set identifier.

24. The method according to claim 23, wherein the request message sent by the UE to the SGSN for transferring to the UTRAN in an idle state is a routing area update request message;

correspondingly, the user information extraction request message is a context request message; and

the user information extraction response message is a context response.

25. The method according to claim 23, wherein the request message sent by the UE to the SGSN for transferring to the UTRAN in an idle state is an attachment request message;

correspondingly, the user information extraction request message is an is identification request message; and

the user information extraction response message is an identification response.

26. The method according to claim 2, wherein after determining to transfer to the UTRAN in an idle state and before correspondingly sending the SGSN a message indicative of the completion of the transfer to the UTRAN in an idle state, the UE generates a key set identifier by mapping the key set identifier of the access security management entity key, and stores the key set identifier, along with the integrity key and the ciphering key which are generated from the key of the access security management entity.

27. The method according to claim 26, wherein the message sent by the UE to the SGSN for indicating the completion of the transfer to the UTRAN in an idle state is a routing area update completion message or an attachment completion message.

28. The method according to claim 2, wherein when the UE transfers from the EUTRAN to the UTRAN under the condition that a radio resource control (RRC) is in an active state, after receiving a handover request, the MME generates an integrity key and a ciphering key using the key of the access security management entity, generates an identifier of the integrity key and the ciphering key, that is, a key set identifier, by mapping the key set identifier of the access security management entity key, and sends the integrity key, the ciphering key and the key set identifier to the SGSN via a forward redirecting request message;

the SGSN stores the ciphering key, the integrity key and the key set identifier; and

after receiving a handover command sent by the network side, the UE generates a key set identifier by mapping the key set identifier of the access security management entity key and stores the key set identifier, along with the integrity key and the ciphering key which are generated from the key of the access security management entity.

29. The method according to claim 2, wherein if a key is associated by the network side and the UE before the UE transfers, and if the key set identifier associated before the transfer is the same as that of the system key which is generated by mapping the key set identifier of the access security management entity key during the transferring process, then the keys stored in the SGSN and the UE before the transfer are deleted.

10. A method for generating an identifier of a key, comprising:

when a UE transfers from an EUTRAN to a global system for mobile communications (GSM) or an enhanced data rate for GSM evolution radio access network (GERAN),

an MME generating an identifier of a ciphering key and an integrity key by mapping a key set identifier for an access security management entity, and sending the ciphering key, the integrity key and the identifier thereof to an SGSN;

the SGSN assigning the value of the identifier of the ciphering key and the integrity key to an identifier of a ciphering key of the GSM or GERAN, that is, the sequence number of the ciphering key; and

the UE generating the identifier of the ciphering key of the GSM or GERAN by mapping the key set identifier of the access security management entity key.

11. The method according to claim 10, wherein the generation mode of the mapping comprises:

the MME directly assigns the value of the identifier of the ciphering key and the integrity key to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and a network side; and

the UE directly assigns the value of the identifier of the ciphering key of the GSM or GERAN to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and the network side.

12. The method according to claim 10, wherein when the UE transfers from the EUTRAN to the GSM or GERAN in an idle state, after receiving a user information extraction request message sent by the UE to the SGSN, the MME generates an integrity key, a ciphering key and an identifier thereof, and sends the integrity key, the ciphering key and the identifier thereof to the SGSN via a user information extraction response message.

13. The method according to claim 12, wherein the request message sent by the UE to the SGSN for transferring to the GSM or GERAN in an idle state is a routing area update request message;

correspondingly, the request message corresponding to the user information extraction request message is a context request message; and

the user information extraction response message is a context response.

14. The method according to claim 12, wherein the request message sent by the UE to the SGSN for transferring to the GSM or GERAN in an idle state is an attachment request message;

correspondingly, the user information extraction request message is an identification request message; and

the user information extraction response message is an identification response.

15. The method according to claim 10, wherein after determining to transfer to the GSM or GERAN in an idle state and before correspondingly sending the SGSN a message indicative of the completion of the transfer to the GSM or GERAN in an idle state, the UE generates an identifier of a ciphering key of the GSM or GERAN by mapping the key set identifier of the access security management entity key, and stores the identifier of the ciphering key of the GSM or GERAN, along with the ciphering key of the GSM or GERAN which is generated from the key of the access security management entity.

16. The method according to claim 15, wherein the message sent by the UE to the SGSN for indicating the completion of the transfer to the GSM or GERAN in an idle state is a routing area update completion message or an attachment completion message.

17. The method according to claim 10, wherein when the UE transfers from the EUTRAN to a UTRAN under the condition that a radio resource control (RRC) is in an active state, after receiving a handover request, the MME generates a ciphering key, an integrity key and an identifier thereof, and sends the integrity key, the ciphering key and the identifier thereof to the SGSN via a forward redirecting request message;

and after receiving a handover command sent by the network side, the UE generates a ciphering key of the GSM or GERAN and an identifier thereof.

18. The method according to claim 10, wherein if a key is associated by the network side and the UE before the UE transfers, and if the identifier of the key associated before the transfer is the same as that of the ciphering key of the GSM or GERAN which is generated through mapping during the transferring process, then the key stored in the SGSN and the UE before the transfer is deleted.

30. The method according to claim 11, wherein when the UE transfers from the EUTRAN to the GSM or GERAN in an idle state, after receiving a user information extraction request message sent by the UE to the SGSN, the MME generates an integrity key, a ciphering key and an identifier thereof, and sends the integrity key, the ciphering key and the identifier thereof to the SGSN via a user information extraction response message.

31. The method according to claim 30, wherein the request message sent by the UE to the SGSN for transferring to the GSM or GERAN in an idle state is a routing area update request message;

correspondingly, the request message corresponding to the user information extraction request message is a context request message; and

the user information extraction response message is a context response.

32. The method according to claim 30, wherein the request message sent by the UE to the SGSN for transferring to the GSM or GERAN in an idle state is an attachment request message;

correspondingly, the user information extraction request message is an identification request message; and

the user information extraction response message is an identification response.

33. The method according to claim 11, wherein after determining to transfer to the GSM or GERAN in an idle state and before correspondingly sending the SGSN a message indicative of the completion of the transfer to the GSM or GERAN in an idle state, the UE generates an identifier of a ciphering key of the GSM or GERAN by mapping the key set identifier of the access security management entity key, and stores the identifier of the ciphering key of the GSM or GERAN, along with the ciphering key of the GSM or GERAN which is generated from the key of the access security management entity.

34. The method according to claim 33, wherein the message sent by the UE to the SGSN for indicating the completion of the transfer to the GSM or GERAN in an idle state is a routing area update completion message or an attachment completion message.

35. The method according to claim 11, wherein when the UE transfers from the EUTRAN to a UTRAN under the condition that a radio resource control (RRC) is in an active state, after receiving a handover request, the MME generates a ciphering key, an integrity key and an identifier thereof, and sends the integrity key, the ciphering key and the identifier thereof to the SGSN via a forward redirecting request message;

and after receiving a handover command sent by the network side, the UE generates a ciphering key of the GSM or GERAN and an identifier thereof.

36. The method according to claim 11, wherein if a key is associated by the network side and the UE before the UE transfers, and if the identifier of the key associated before the transfer is the same as that of the ciphering key of the GSM or GERAN which is generated through mapping during the transferring process, then the key stored in the SGSN and the UE before the transfer is deleted.

19. A system for generating an identifier of a key, which is suitable for generating an identifier of a system key when a UE transfers from an EUTRAN to a UTRAN, comprising:

a UE, a mobility management entity (MME) and a serving GPRS support node (SGSN), wherein;

the UE being used for mapping a key set identifier for an access security management entity into a key set identifier of a UTRAN system;

the MME being used for mapping a key set identifier for the access security management entity into a key set identifier of the UTRAN system and sending the obtained identifier to the SGSN;

the mapping mode being as follows;

the UE and the MME directly assign the value of the key set identifier of the UTRAN system to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and a network side.

20. The system according to claim 19, wherein,

the UE comprises:

a first key set identifier mapping unit, for generating an identifier of an integrity key and a ciphering key through mapping, and mapping the value of a key set identifier of the access security management entity key (KSI_ASME), or the value of the identifier KSI_ASME plus an appointed constant, to the identifier of the integrity key and the ciphering key;

a first key and identifier thereof storing unit, which is used for storing the ciphering key, the integrity key and the identifier of the ciphering key and the integrity key which is generated by the first key set identifier mapping unit;

the MME comprises;

a second key set identifier mapping unit, for generating an identifier of an integrity key and a ciphering key, and mapping the value of a key set identifier of the access security management entity key (KSI_ASME), or the value of the identifier KSI_ASME plus an appointed constant, to the identifier of the integrity key and the ciphering key;

a security parameter sending unit, for sending the SGSN the ciphering key, the integrity key, and the identifier of the ciphering key and the integrity key which is generated by the second key set identifier mapping unit;

the SGSN comprises;

a security parameter receiving unit, for receiving the ciphering key, the integrity key and the identifier thereof which are sent by the MME;

a third key and identifier thereof storing unit, which is used for storing the received ciphering key and integrity key and the identifier thereof.

21. A system for generating an identifier of a key, which is suitable for generating an identifier of a system key when a UE transfers from an EUTRAN to a GSM or GERAN, comprising:

a UE, a mobility management entity (MME) and a serving GPRS support node (SGSN), wherein,

the UE being used for generating an identifier of a ciphering key of the GSM or GERAN by mapping a key set identifier for an access security management entity;

the MME being used for generating an identifier of a ciphering key and an integrity key by mapping a key set identifier for the access security management entity, and sending the ciphering key, the integrity key and the identifier thereof to the SGSN;

the SGSN being used for receiving the ciphering key, the integrity key and the identifier thereof which are sent by the MME, and assigning the value of the identifier of the ciphering key and the integrity key to the identifier of the ciphering key of the GSM or GERAN;

the mapping generation mode being as follows;

the MME directly assigning the value of the identifier of the ciphering key and the integrity key to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and a network side, and the UE directly assigning the value of the identifier of the ciphering key of the GSM or GERAN to be that of the key set identifier of the access security management entity key, or to be the sum of the value of the key set identifier of the access security management entity key and a constant which is appointed by the UE and the network side.

22. The system according to claim 21, wherein,

the UE comprises:

a first key set identifier mapping unit, for mapping the value of a key set identifier of the access security management entity key (KSI_ASME), or the value of the identifier KSI_ASME plus a constant, to the identifier of the ciphering key of the GSM or GERAN;

a first key and identifier thereof storing unit, which is used for storing the ciphering key of the GSM or GERAN and the identifier thereof;

the MME comprises;

a second key set identifier mapping unit, for generating an identifier of the integrity key and the ciphering key, and mapping the value of the key set identifier of the access security management entity key, or the value of the key set identifier of the access security management entity key plus a constant, to the identifier of the integrity key and the ciphering key;

a security parameter sending unit, for sending the SGSN the ciphering key, the integrity key, and the identifier of the ciphering key and the integrity key which is generated by the second key set identifier mapping unit;

the SGSN comprises;

a security parameter receiving unit, for receiving the ciphering key, the integrity key and the identifier thereof which are sent by the MME;

a third key set identifier mapping unit, for assigning the value of the ciphering key, the integrity key and the identifier thereof to the identifier of the ciphering key of the GSM or GERAN;

a third key and identifier thereof storing unit, which is used for storing the ciphering key of the GSM or GERAN and the identifier thereof.